guest-agent: freeze the v0 API at v0.5.11 and add the versioned v1 API

README.md

@@ -155,6 +155,7 @@ Apps communicate with the guest agent via HTTP over `/var/run/dstack.sock`. Use
 - [Gateway](./docs/dstack-gateway.md) - Gateway configuration
 
 **Reference**
+- [Guest Agent API v1](./docs/guest-api-v1.md) - Key derivation, signature chains, and the versioned guest API
 - [App Compose Format](./docs/normalized-app-compose.md) - Compose file specification
 - [Intel TDX Attestation](./docs/attestation-tdx.md) - Measurement and runtime-event verification
 - [Native TEE Interfaces](./docs/native-tee-interfaces.md) - Advanced compatibility with Linux TEE devices and configfs-tsm

REUSE.toml

@@ -45,7 +45,6 @@ path = [
     "tools/sca/examples/hello-c/config.json",
     "tools/sca/examples/heartbeat/rootfs/etc/heartbeat/interval",
     "sdk/simulator/*.json",
-    "sdk/tests/vectors/*.json",
     "sdk/go/go.sum",
     "sdk/go/ratls/go.sum",
     "dstack/kms/dstack-app/builder/shared/builder-pinned-packages.txt",

docs/amd-sev-snp.md

@@ -88,8 +88,8 @@ MrConfigV3 document through `HOST_DATA`, so a verifier can validate the report
 and document binding and then compare this field with the expected GPU policy
 digest. If the field is absent, this optional check is not asserted. This binds
 the GPU policy, but not the later `gpu-attestation` runtime event or the
-`GpuInfo` output: the current SEV-SNP path has no quote-bound runtime
-measurement register.
+boot-time GPU evidence returned by `/v1/Attest`: the current SEV-SNP path has
+no quote-bound runtime measurement register.
 
 The verifier supports the AMD Milan, Genoa, and Turin KDS product families.
 Bergamo and Siena are handled through AMD's canonical Genoa KDS product path.

docs/app-health-checks.md

@@ -46,7 +46,7 @@ older guest chokes on.
 ## Where the verdict comes from
 
 The guest agent recomputes a verdict every 5 seconds and caches it; the gateway
-polls `Worker.Health`, which only reads that cache. The two cadences are
+polls `/prpc/v1/Health`, which only reads that cache. The two cadences are
 independent on purpose — a fleet of gateway nodes polling the same instance must
 not multiply into that many container-runtime queries inside the CVM, and the
 RPC is served on the CVM's publicly reachable listener.

docs/attestation-tdx.md

@@ -45,7 +45,7 @@ evaluation, `gpu-attestation`. The `gpu-policy-hash` payload is
 The `gpu-attestation` payload is JSON containing the verified device count,
 CC/DevTools state, and `evidence_sha256`.
 
-The guest-agent `GpuInfo` API returns the complete `nvattest` JSON captured during boot; `Attest` returns the same bytes in `boottime_gpu_evidence` when called with `include_boottime_gpu_evidence`, so a verifier can fetch the quote and the GPU evidence in one round trip. It is not trustworthy by itself. (`AttestGpu` runs a *fresh* attestation against a caller nonce, but its result is not bound to the TD and must not be used as remote evidence; only the boot-time record below is.) After verifying the TDX quote and replaying the event log to RTMR3, hash the exact UTF-8 bytes of `GpuInfo.attestation` (or `Attest.boottime_gpu_evidence`) and require the result to equal the `gpu-attestation` event's `evidence_sha256`. See [GPU Security for AI Workloads](./security/security-model.md#gpu-security-for-ai-workloads) for the event schema, ordering, Rego example, and platform differences.
+The guest-agent returns the complete `nvattest` record captured during boot from `/v1/Attest`, when the request sets `include_boottime_gpu_evidence`, so a verifier can fetch the quote and the GPU evidence in one round trip. `AttestResponse.boottime_gpu_evidence` is a list of `GpuEvidenceBundle` (`{vendor, format, evidence}`); the boot record is the bundle whose `vendor` is `nvidia` and whose `format` is `nvidia-nvattest-boottime-json-v1`, and its `evidence` is hex-encoded bytes that decode to the exact UTF-8 `nvattest` output. It is not trustworthy by itself. (`/v1/AttestGpu` runs a *fresh* attestation against a caller nonce and returns bundles tagged `nvidia-nvattest-collect-evidence-json-v1`, a deliberately distinct format that a boot-record verifier does not appraise; its result is not bound to the TD and must not be used as remote evidence; only the boot-time record below is.) After verifying the TDX quote and replaying the event log to RTMR3, hash the *decoded* bundle bytes — `SHA-256(hex_decode(bundle.evidence))`, never the JSON string as returned nor a re-serialized form — and require the result to equal the `gpu-attestation` event's `evidence_sha256`. See [GPU Security for AI Workloads](./security/security-model.md#gpu-security-for-ai-workloads) for the event schema, ordering, Rego example, and platform differences.
 
 ### 2.2. Determining expected MRs
 MRTD, RTMR0, RTMR1, and RTMR2 correspond to the image. dstack OS builds all related software from source.

docs/aws-ec2-production-verifier-runbook.md

@@ -214,8 +214,12 @@ For GPU workloads, PCR14 also contains `gpu-policy-hash` immediately after
 `SHA-256(JCS(requirements.gpu_policy))`, using `{}` when the policy is omitted.
 Because the verifier replays the event chain against the signed NitroTPM
 Attestation Document, this validates `gpu_policy_hash` on AWS. A successful GPU
-launch also adds `gpu-attestation`; its `evidence_sha256` can be compared with
-the exact UTF-8 bytes returned by `GpuInfo.attestation` after PCR14 replay.
+launch also adds `gpu-attestation`; after PCR14 replay, its `evidence_sha256`
+can be compared with `SHA-256(hex_decode(bundle.evidence))`, where `bundle` is
+the `AttestResponse.boottime_gpu_evidence` entry whose `format` is
+`nvidia-nvattest-boottime-json-v1`, returned by `/v1/Attest` when the request
+sets `include_boottime_gpu_evidence`. Hash the decoded bytes exactly as
+returned, not a re-serialized form.
 
 The guest also extends a `MrConfig` V2 **config commitment** into **PCR8**
 (`PCR8 = sha384(0^48 || config_id)`). This is **optional** and exists only to